PT-2024-29343

CVE-2024-41270

Published

2024-08-06

Updated

2024-08-19

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gorush version 1.18.4

Description An issue in the RunHTTPServer function allows attackers to intercept and manipulate data due to the use of a deprecated TLS version.

Recommendations For Gorush version 1.18.4, consider updating to a version that uses a non-deprecated TLS version to prevent data interception and manipulation. As a temporary workaround, consider restricting access to the RunHTTPServer function until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Related identifiers

CVE-2024-41270

GHSA-P3PF-MFF8-3H47